# Reverse Engineering Wise

Extract files from Wise installers without executing them.

The aim of this project is to extract assets from old game installers made with
Wise installer without executing the PE file (.exe), so they can be used with
free software implementations of the game engine.

```bash
==============================================================
              Welcome to REWise version 0.1.0
==============================================================

 Usage: rewise [OPERATION] [OPTIONS] INPUT_FILE

  OPERATIONS
   -x --extract      OUTPUT_PATH  Extract files.
   -r --raw          OUTPUT_PATH  Extract all files in the overlay data. This does not move/rename files!
   -l --list                      List files.
   -V --verify                    Run extract without actually outputting files, crc32s will be checked.
   -z --script-debug              Print parsed WiseScript.bin
   -v --version                   Print version and exit.
   -h --help                      Display this HELP.

  OPTIONS
   -p --preserve                  Don't delete TMP files.
   -t --tmp-path     TMP_PATH     Set temporary path, default: /tmp/
   -d --debug                     Print debug info.
   -s --silent                    Be silent, don't print anything.
   -n --no-extract                Don't extract anything. This will be ignored with -x or -r. It also will not try to remove TMP files, so -p won't do anything.

  NOTES
    - Path to directory OUTPUT_PATH and TMP_PATH should exist and be writable.
    - All files REWise does output will be overwritten when they exist!
```


# Acknowledgement

The `WiseUnpacker` project helped a lot to give insight on how to unpack files
from Wise installers. The `REWise` inflation process is heavily based on the
inflation process of `WiseUnpacker`. So a lot of thanks to
[mnadareski](https://github.com/mnadareski/)!

Unlike `WiseUnpacker` which tries to support all versions of Wise installers,
REWise tries to focus on old game installers (1999-2003) in the form of PE
executables. But when `REWise` fails to extract any Wise installer feel free
to open an [issue](https://notabug.org/CYBERDEViL/REWise/issues) (no
guarantees!).


# Technical

 > NOTE: The PE build date will not be the same as the installer creation date
 > (or release date) since the overlay-data is just appended to a existing
 > Wise PE on creation of the installer. The supported installer release
 > dates seen so far are between 1999 and 2003. While the PE build dates are
 > between 1998 and 2001.

A Wise installer is a PE executable (NE is also possible, but not supported at
this time) with extra data appended to the end of it (overlay-data at the
overlay-offset). The overlay-data contains a Wise specific header which is not
very important to us (it might be, but no useable values have been found yet).
After the Wise header there is raw `DEFLATE`d data without file-headers, after
each `DEFLATE`d data entry there is a CRC32 for the inflated data. The
`DEFLATE`d data + CRC32 continues until `EOF`.

The first inflated file is a `.dib` file containing colours used by the
installer, it is no use for us so we skip it.

The second inflated file is a binary file that has all sorts of data relevant
for the installation (including custom file headers). Within REWise this file
is named `WiseScript.bin`. Most time was spend on reverse engeneering
different `WiseScript.bin` files with a hex-editor (ImHex) so a
`WiseScript.bin` can be parsed without as much of guessing as possible. One
discovered struct that is the most relevant for extracting files that would be
installed by the installer is (it contains file names, metadata, CRC32 and
offset to deflatedata):

```c
/* 0x00 WiseScriptFileHeader */
typedef struct {
  unsigned char unknown_2[2];   // seen: 0x8000, 0x8100, 0x0000, 0x9800 0xA100
  uint32_t deflateStart;
  uint32_t deflateEnd;
  uint16_t date;
  uint16_t time;
  uint32_t inflatedSize;
  unsigned char unknown_20[20]; // 20 * \0?
  uint32_t crc32;               // do not check when it is 0
  char * destFile;              // \0 terminated string
  char * fileText;              // \0 terminated string
  unsigned char terminator;     // always \0? terminator?
} WiseScriptFileHeader;
```

On how `REWise` handles a `WiseScript.bin` file: SEE `src/wisescript.h` and
`src/wisescript.c`.


# State

## Known working Wise installers

SHORT       | SOURCE     | FULL
:---------- | :--------- | :--------------------------------------------
CS15        | Download   | Counter-Strike 1.5 (2001)
ET          | Download   | Wolfenstein: Enemy Territory (2001)
GSPY220     | Download   | GameSpy 220 std (2000)
HL:CS       | Retail CD  | Half-Life Counter-Strike (2000)
HL:GOTY     | Retail CD  | Half-Life Game Of The Year Edition (1999)
HL1WON      | Download   | Half-Life 1 WON 1.1.1.0 Patch (2002)
HL23SDK     | Download   | Half-Life SDK 2.3 (2002)
HL:STEAM    | Download   | Steam Client with Half-Life Cache (2003)
HL:UL       | Download   | Half-Life Uplink (1999)
OPFOR:DEMO  | Download   | Half-Life:Opposing Force Demo (2000)
RTCW        | Retail CD  | Return to Castle Wolfenstein (2001)
RTCW:MPDEMO | Download   | Return to Castle Wolfenstein Multi-Player Demo (2001)
RTCW:SPDEMO | Download   | Return to Castle Wolfenstein Single-Player Demo (2001)

___

SHORT       | FILENAME                   | PE BUILD
:---------- | :------------------------- | :-----------------------------
CS15        | csv15full.exe              | Mon Aug 13 19:13:38 2001 UTC+1
ET          | WolfET.exe                 | Thu Oct 25 21:47:11 2001 UTC+1
GSPY220     | gamespyinstaller220std.exe | Fri May 21 22:48:48 1999 UTC+1
HL:CS       | counter-strike.exe         | Tue Aug 17 17:25:48 1999 UTC+1
HL:GOTY     | SETUP.EXE                  | Tue Apr 25 16:37:12 2000 UTC+1
HL1WON      | hl1110.exe                 | Mon Aug 13 19:13:38 2001 UTC+1
HL23SDK     | hl_sdk_v23.exe             | Thu Oct 25 21:47:11 2001 UTC+1
HL:STEAM    | steaminstall_halflife.exe  | Thu Oct 25 21:47:11 2001 UTC+1
HL:UL       | hluplink.exe               | Mon Nov  9 21:17:09 1998 UTC+1
OPFOR:DEMO  | opfordemofull.exe          | Fri May 21 22:48:48 1999 UTC+1
RTCW        | Setup.exe                  | Tue Apr 25 16:37:12 2000 UTC+1
RTCW:MPDEMO | Wolf_MPDemo.exe            | Tue Apr 25 16:37:12 2000 UTC+1
RTCW:SPDEMO | wolf_spdemo.exe            | Tue Apr 25 16:37:12 2000 UTC+1


## What can be done better

In general:

 - Error handling.
 - The inflate process is currently custom made with
   `https://github.com/mnadareski/WiseUnpacker` as a source of information. It
   is doing fine but it probably will be better and faster with a `zlib`
   implementation.

Values that are currently calculated that might be in the WiseHeader,
somewhere in WiseScript.bin or a constant defined somewhere else are:

 - Total inflated size.
 - The deflate-offset that is added to deflateStart defined in the
   WiseScript.bin file.

Other values that are of interest but not found yet are:

 - To determine what Wise package/version was used other then the PE build
   date.
   On [Wikipedia](https://en.wikipedia.org/wiki/Wise_installer) is a list of
   different Wise installer releases, comparing that list to the tested
   installers (games) their PE build date it suggests that the
   targeted Wise installer versions are either one of these:

    - WISE Installation System version 7 (1998) (InstallMaker)
    - WISE Installation System version 7 (1998) (InstallMaster)
    - WISE Installation System version 8 (1999) (InstallBuilder)
    - WISE Installation System version 8 (1999) (InstallMaker)
    - WISE Installation System version 8 (1999) (InstallMaster)
    - WISE Installation System version 9 (2001)

## Things that might be a problem

 - REWise is only tested on Little Endian systems.
 - Wise installers where the PE was build before 1998 or after 2001, or
   installers that where created/released before 1999 or after 2003.


# Many thanks to

 - The [WiseUnpacker project](https://github.com/mnadareski/WiseUnpacker) for
   a great source of information.
 - The [FragNet community](https://www.frag-net.com) for testing and feedback.

# Other projects

 - https://github.com/mnadareski/WiseUnpacker
 - https://github.com/lmop/exwise
